Client-specific Property Inference against Secure Aggregation in Federated Learning

Raouf Kerkouche,Gergely Ács,Mario Fritz

2023-10-28

Abstract:Federated learning has become a widely used paradigm for collaboratively training a common model among different participants with the help of a central server that coordinates the training. Although only the model parameters or other model updates are exchanged during the federated training instead of the participant's data, many attacks have shown that it is still possible to infer sensitive information such as membership, property, or outright reconstruction of participant data. Although differential privacy is considered an effective solution to protect against privacy attacks, it is also criticized for its negative effect on utility. Another possible defense is to use secure aggregation which allows the server to only access the aggregated update instead of each individual one, and it is often more appealing because it does not degrade model quality. However, combining only the aggregated updates, which are generated by a different composition of clients in every round, may still allow the inference of some client-specific information. In this paper, we show that simple linear models can effectively capture client-specific properties only from the aggregated model updates due to the linearity of aggregation. We formulate an optimization problem across different rounds in order to infer a tested property of every client from the output of the linear models, for example, whether they have a specific sample in their training data (membership inference) or whether they misbehave and attempt to degrade the performance of the common model by poisoning attacks. Our reconstruction technique is completely passive and undetectable. We demonstrate the efficacy of our approach on several scenarios which shows that secure aggregation provides very limited privacy guarantees in practice. The source code will be released upon publication.

Cryptography and Security,Machine Learning

What problem does this paper attempt to address?

The problem that this paper attempts to solve is that in federated learning, even with the use of Secure Aggregation technology, there is still a risk of inferring client - specific attributes from the aggregated model updates. Specifically, the paper focuses on two main aspects:

1. **Membership Detection**: Identify which clients have specific target samples in their training data. Such detection can be used to determine whether a data point belongs to a participant's training set, thereby leaking sensitive information.

2. **Misbehaving Detection**: Identify malicious clients that execute Poisoning Attacks, which aim to reduce the overall performance of the federated model by modifying local model updates.

To achieve the above goals, the paper proposes a general, fully passive reconstruction technique called PROLIN. PROLIN takes advantage of the linear characteristics of model aggregation, captures attribute information from the aggregated model updates through a linear model, and attributes it to specific clients. This method does not require any background knowledge about specific clients, only the aggregated model observed in each round and the identities of the clients participating in each round. The paper demonstrates the effectiveness of PROLIN in multiple scenarios, proving that even with the use of secure aggregation, it is still possible to infer client - specific information, indicating that the privacy protection provided by secure aggregation in practice is limited.